CVE-2014-0114
82Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 96%
da publicação à arma0 dias
Publicada no NVD30 de abr.
1ª PoC6 de mar.
metasploit6 de mar.
VulnCheck+2933d
probabilidade de exploração
96%top 1% das CVEs
exploração observada
simVulnCheck
4 exploit(s) público(s)
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41690githubgithub.com/rgielen/struts1filter★ 12githubgithub.com/aenlr/strutt-cve-2014-0114★ 2githubgithub.com/ricedu/struts1-patch★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://advisories.mageia.org/MGASA-2014-0219.htmlhttp://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.htmlhttp://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txthttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.htmlhttp://marc.info/?l=bugtraq&m=140119284401582&w=2http://marc.info/?l=bugtraq&m=140801096002766&w=2http://marc.info/?l=bugtraq&m=141451023707502&w=2http://openwall.com/lists/oss-security/2014/06/15/10http://openwall.com/lists/oss-security/2014/07/08/1https://access.redhat.com/errata/RHSA-2018:2669https://access.redhat.com/errata/RHSA-2019:2995https://access.redhat.com/solutions/869353